[ISSUE] databricks_sql_permissions causes perpetual plan changes: catalog becomes database/default

[vynaloze]

[split from #619]

Terraform Version

Terraform v0.14.10
+ provider registry.terraform.io/databrickslabs/databricks v0.3.3

Affected Resource(s)

• databricks_sql_permissions

Environment variable names

DATABRICKS_HOST
DATABRICKS_TOKEN

Terraform Configuration Files

There is only a single database in this scenario. The use case is that I want to enable access to any new databases (possibly created in the future) to data_admin, while denying data_read_only access to them.

resource "databricks_sql_permissions" "catalog" {
  catalog = true

  privilege_assignments {
    principal = "data_admin"
    privileges = [
      "SELECT",
      "CREATE",
      "MODIFY",
      "USAGE",
      "READ_METADATA",
    ]
  }
}

resource "databricks_sql_permissions" "database" {
  database = "test"

  privilege_assignments {
    principal = "data_admin"
    privileges = [
      "SELECT",
      "CREATE",
      "MODIFY",
      "USAGE",
      "READ_METADATA",
    ]
  }

  privilege_assignments {
    principal = "data_read_only"
    privileges = [
      "SELECT",
      "USAGE",
      "READ_METADATA",
    ]
  }
}

Expected Behavior

No changes should be detected when running subsequent plans after initial apply

Actual Behavior

After initial apply, running plan produces following output, given configuration file above:

  # databricks_sql_permissions.catalog must be replaced
-/+ resource "databricks_sql_permissions" "catalog" {
      - anonymous_function = false -> null
      - any_file           = false -> null
      ~ catalog            = false -> true # forces replacement
      ~ cluster_id         = "REDACTED" -> (known after apply)
      ~ id                 = "database/default" -> (known after apply)
        # (1 unchanged attribute hidden)

        # (1 unchanged block hidden)
    }

  # databricks_sql_permissions.database will be updated in-place
  ~ resource "databricks_sql_permissions" "database" {
        id                 = "database/test"
        # (5 unchanged attributes hidden)

      ~ privilege_assignments {
          ~ principal  = "data_read_only" -> "data_admin"
          ~ privileges = [
              + "CREATE",
              + "MODIFY",
                # (3 unchanged elements hidden)
            ]
        }
      ~ privilege_assignments {
          ~ principal  = "data_admin" -> "data_read_only"
          ~ privileges = [
              - "CREATE",
              - "MODIFY",
                # (3 unchanged elements hidden)
            ]
        }
    }

(note #619 is still there, even though there are two assignments now instead of three)

Steps to Reproduce

1. terraform apply
2. terraform plan (or apply, whatever)